Re: packet flow - ebtables broute DROP target

[Bart De Schuymer <bdschuym@pandora.be>]

Aijaz Baig schreef:
> Hello Bart and Jan,
>
> Sorry for the belated reply. Im in India so the time gaps makes it bad.
> Thank you for your great inputs. I would surely consider them now. Thank
> you Jan for letting us know you guys are writing a book on netfilter.
> Lord knows we need it. More and more companies across the globe are
> using linux more and more now. This would be of immense help to
> academicians and professionals alike.
>
> Ive got 2 linux boxes, one virtual and one real. The real one has a eth0
> interface which connects to my LAN. It's vmnet8 interface is behind the
> virtual linux box's eth0 interface i.e. the latter is the former's
> gateway. The virtual box has 3 interfaces eth0, eth1 and eth2. Out of
> which eth0 and eth1 are bridged and enslaved to br0. eth2 connects to
> the same LAN as does my real box's eth0. I have added a static route for
> a PC in my outer LAN to force the traffic to go through vmnet8.
>
> Now when I DROP packets for the target PC in the broute table, the
> problem that I described above happens. I did what was told to be done
> as shown the basic brouter example. But still..zilch..nothing seemed to
> be working. 
>
> To be specific, I added a rule:
> ebtables -t broute -A BROUTING -p 0x806 --d$MAC_OF_eth0 -j DROP 
> to allow the arp replies to arrive on eth0 and not on br0. But even
> after that it didn't work. Even the packet count for this new rule was
> zero all the time so I guess something was suspicious here.
>
> Could someone, bart maybe, let me know what it means by his quote: "Your
> traffic is probably dropped by the networking code because the 
> destination MAC address differs from that of the bridge port."
>
> May be I don't really know ARP works to infer how such a rule would be
> helpful in the first place.
>
>   
This is explained at the link I gave you. If something is unclear in my 
description on the website, feel free to let me know.
Try it out with the example rules I mention on that site and adapt to 
your situation from there. In the future, please explicitly list your 
complete test setup, including a dump of the firewall tables.

cheers,
Bart


-- 
Bart De Schuymer
www.artinalgorithms.be